'I've Got Nothing to Hide' and Other Misunderstandings of Privacy Paper

Here is a long but really good paper countering the "I have nothing to hide" argument.

From the abstract:

" In this short essay, written for a symposium in the San Diego Law Review, Professor Daniel Solove examines the nothing to hide argument. When asked about government surveillance and data mining, many people respond by declaring: "I've got nothing to hide." According to the nothing to hide argument, there is no threat to privacy unless the government uncovers unlawful activity, in which case a person has no legitimate justification to claim that it remain private. The nothing to hide argument and its variants are quite prevalent, and thus are worth addressing. In this essay, Solove critiques the nothing to hide argument and exposes its faulty underpinnings."

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=998565#PaperDownload

More on the updated FISA 2008 bill

From wired blog:

http://blog.wired.com/27bstroke6/2008/06/house-grants-te.html

"The bill allows the National Security Agency to order phone companies, ISPs and online service providers to turn over all communications that have one foreigner as a party to the conversation. If any Americans are party to the conversation, the government is supposed to mask their names, but these procedures to minimize privacy-invasion are easily overridden. The longstanding Foreign Intelligence Surveillance Act required specific court orders to wiretap phone and internet lines inside the United States, but did not regulate spying conducted on non-U.S. soil.

Under the so-called FISA Amendments Act of 2008, the government would need a court order to wiretap an American overseas, regardless of where the tap was. Under the current regime, targeted taps aimed at Americans overseas requires the sign-off of the attorney general.

The nation's telecoms will soon be freed from some 40 lawsuits accusing them of eavesdropping illegally, if the bill is passed into law as expected. The legality of the retroactive amnesty isn't clear, and groups like the American Civil Liberties Union and Electronic Frontier Foundation will likely challenge the provision on constitutional grounds."

I read about 20 pages of 100+ of the bill on the surface it seemed ok, but two issues bother me personally. First, it lets the ISPs off the hook for doing what their legal departments should have known and told them was illegal. In the military you are taught to never follow an illegal order, it should be the same outside of the military as well. Second, we mere virtual inches from a blanket wiretap on everyone deemed "a threat" and I've already heard from people that work at ISPs it doesn't take much to get a tap on your cable/DSL modem anyway. Sad times. Time to get good at PGP, TrueCrypt and secure protocols if you aren't there already.

And a little further in the toilet we go...

From wired blog:

http://blog.wired.com/27bstroke6/2008/06/dems-agree-to-e.html

"Breaking months of acrimonious deadlock, House and Senate leaders from both parties have agreed to a bill that gives the nation's spy agencies the power to turn a wide swath of domestic communication companies into intelligence-gathering operations, and that puts an end to court challenges to telecoms such as AT&T that aided the government's secret, five-year warrantless wiretapping program."

There isnt much to say if you read the article, its shameful the FUD still flows and becomes law in the name of terrorism 7 years after 9/11.

British ISP Syping On Users

Ok, this one is a little bit Dale Gribble...

From Wired Blog:

"An internal British Telecom report on a secret trial of an ISP eavesdropping and advertising technology found that the system crashed some unsuspecting users' browsers, and a small percentage of the 18,000 broadband customers under surveillance believed they'd been infected with adware."

"Those boxes inserted JavaScript code into every web page downloaded by the users. That script then reported back to Phorm the contents of the web page, which Phorm used to create ad profiles of a user. Additionally, Phorm purchased advertising space on prominent web sites, showing a default ad for a charity. But when a user who had previously looked at car sites visited one of those pages, he instead got an advertisement for car insurance."

http://blog.wired.com/27bstroke6/2008/06/isp-spying-made.html

1984 was a typo! -- No Place to Hide Pseudo Book Review

I really blame phn1x for actually answering my question of what Safeway does with the information of what you buy and suggesting the book "No Place to Hide" by Robert O'Harrow.

Google Books Link:
http://books.google.com/books?hl=en&id=caydrFMa1mIC&dq

I won't do the typical review I do because its not a "tech" book but I will say that it was eye opening. I'm embarrassed to not know the scope of information (and how easily we give it up) that is being accumulated about us by different commercial organizations (ChoicePoint, Acxiom, and more), computer generated models of our likes and dislikes formulated and sold to various vendors, private information about us from marriage, mortgages, books checked out from the library, you name it, and of course that information being easily sold to the government so they can live up to laws forbidding the government from spying on citizens by the government itself not actually doing the spying but merely buying data and services from these vendors.

I don't want to go all Dale Gribble (more) but some fun/spooky/scary things from the book.

1. you dont have to fill out warranty cards that ask for all that personal info like how much you make and what kind of car you drive. By law all products have a 1 yr warranty without you having to mail in that registration card.

2. your phone number is your new SSN and the "key" tying good chunks of your data to you. Add your zip code to make sure there are no mistakes.

3. where do these companies get the data? From: telephone directories, voter registrations forms, tax assessor offices, questionnaires, warranty cards, catalog buyer behavior information, and product registration forms.

4. who generated the initial no fly lists? yep those companies.

5. best part, all the data policing is done by the companies and not the government.

And for a real world example, in my mailbox yesterday was some junk mail from some Baptist church. Of course called and said thanks for the letter but how the f**k did you get my name and address. The utility company gave it to them...WTF.

EFF and EPIC can expect good donations this year, as long as they don't write down my name and address so the government doesn't have its initial start list of dissidents when things go south. But its probably waaaaaaay to late to worry about that. I know I'm already on that list.

For Cons of the book, read the reviews on amazon they mostly say the same thing. Basically great information, but no remediation. fI there even is any at this point.

If you want to see what they have on you, at least ChoicePoint appears to do this for free if you are willing to cough up some information.
http://www.choicepoint.com/consumer/all_products.html

also opt-out info:
http://www.privacyatchoicepoint.com/optout_ext.html

New Year Paranoia Thoughts

As we were at Safeway buying champagne and the sparking apple cider for the party last nite it really dawned on me the amount of personal data we give to stores in exchange for a couple dollars off at the register.

When you think about it, would you regularly post on the net when you buy condoms or butt cream from the drug store, or EVERYTHING you bought from the grocery store. While I don't consider myself strange or to have weird eating habits, I don't know that I'd be comfortable letting everyone know what I was buying -- even though evidently I am because i take my couple dollar discount.

While most of the info is just for marketing or statistics, some you have to wonder what its for. For example, Safeway (a grocery store) you enter in your phone number and you get the "Safeway member price" on alot of things that are on sale that week, thats cool, and i usually save 3 or 4 dollars per visit. But what does safeway do with that data? i don't get coupons or things like that in the mail or email (you only give them name and phone number but alot of stores ask for email now too) but where is all that information going and who is using it?

So, two thoughts I took away from it were:

1. Looking back at my maltego post (or just using google) look at the amount of information you can find about someone if you just know there name, email and phone number...kinda scary

2. Can that information be used to incriminate you? Say I was a suspect in a murder case and I had bought (and swiped my member rewards card) at the local hardware store when I bought lime, shovel, trash bags, and rope --hope I didn't pay with my debit mastercard either.

So, I guess my question is, in this day and age of really working hard to protect the privacy of our online identity with TOR, anonymous email accounts, limiting what personal information we do give out, and your favorite flavor or PGP do we need to work harder to protect our physical (real/human) identities, especially when that information is so easily and pretty much instantaneously transfered into the online realm?

I think I'll continue using the in-laws information at Safeway...just in case.

Happy New Year!